CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- vesparny marky, red hat logging subsystem for red hat openshift, satellite 6 +2 moreMarky 0.0.1 - Persistent Cross-Site Scripting5.1 Medium
- dvcrn markrightMarkright 1.0 - Persistent Cross-Site Scripting5.1 Medium
- amitmerchant1990 markdownifyMarkdownify 1.2.0 - Persistent Cross-Site Scripting5.1 Medium
- jersou markdown explorerMarkdown Explorer 0.1.1 - Persistent Cross-Site Scripting5.1 Medium
- freeterFreeter 1.2.1 - Persistent Cross-Site Scripting5.1 Medium
- schlix cmsSchlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting (Authenticated)5.1 Medium
- gearboxcomputers wifihotspotWifiHotSpot 1.0.0.0 - 'WifiHotSpotService.exe' Unquoted Service Path8.5 High
- sandboxie-plus sandboxieSandboxie 5.49.7 - Denial of Service4.6 Medium
- weird-solutions dhcp broadbandDHCP Broadband 4.1.0.1503 - 'dhcpt.exe' Unquoted Service Path8.5 High
- weird-solutions bootp turboBOOTP Turbo 2.0.0.1253 - 'bootpt.exe' Unquoted Service Path8.5 High
- webssh for iosWebSSH for iOS 14.16.10 - 'mashREPL' Denial of Service4.6 Medium
- acer backup manager moduleAcer Backup Manager Module 3.0.0.99 - 'IScheduleSvc.exe' Unquoted Service Path8.5 High
- acer updater serviceAcer Updater Service 1.2.3500.0 - 'UpdaterService.exe' Unquoted Service Path8.5 High
- splinterware idailydiaryiDailyDiary 4.30 - Denial of Service (PoC)4.6 Medium
- acer epowersvcePowerSvc 6.0.3008.0 - 'ePowerSvc.exe' Unquoted Service Path8.5 High
- diskboss serviceDiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service Path8.5 High
- raimersoft rarmaradioRarmaRadio 2.72.8 - Denial of Service4.6 Medium
- ubeeinteractive ubee evw327Ubee EVW327 - 'Enable Remote Access' Cross-Site Request Forgery (CSRF)5.1 Medium
- dupterminatorDupTerminator 1.4.5639.37199 - Denial of Service4.6 Medium
- thecus n4800eco nas server control panelThecus N4800Eco Nas Server Control Panel - Command Injection5.3 Medium
- pyasn1, debian linux, red hat lightspeed core +48 more +50 morepyasn1 has a DoS vulnerability in decoder7.5 High
- the browser company of new york diaCVE-2025-15032: Increased Spoofing risk; custom new window missing about:blank7.4 High
- go standard library crypto/tls, golang go +1 moreUnexpected session resumption in crypto/tls10.0 Critical
- go toolchain cmd/go, golang go, red hat enterprise linux 10 +30 more +32 moreArbitrary file write using cgo pkg-config directive in cmd/go7.8 High
- go toolchain cmd/go, golang go +1 moreUnexpected code execution when invoking toolchain in cmd/go7.0 High
- go standard library crypto/tls, golang go +1 moreHandshake messages may be processed at the incorrect encryption level in crypto/tls5.3 Medium
- go standard library archive/zip, golang go +1 moreExcessive CPU consumption when building archive index in archive/zip6.5 Medium
- go standard library net/url, golang go, red hat assisted installer for red hat openshift container platform 2 +160 more +162 moreMemory exhaustion in query parameter parsing in net/url7.5 High
- tp-link systems inc. vigi c230i mini, vigi c240 1.0, vigi c250 +31 more +33 moreAuthentication Bypass in Password Recovery Feature via Local Web App on Multiple VIGI Cameras8.7 High
- apple xcodeA permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3...3.3 Low
- apple ipados, ios and ipados, iphone os +2 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3...3.3 Low
- apple macosA logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26...5.5 Medium
- apple macosThis issue was addressed with improved permissions checking. This issue is fixed in macOS Sequoia...3.3 Low
- apple ipados, ios and ipados, iphone os +2 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3...5.3 Medium
- apple ipados, ios and ipados, iphone os +2 moreThis issue was addressed through improved state management. This issue is fixed in iOS 18.1 and...2.4 Low
- apple ipados, macos, ios and ipados +1 more +3 moreThe issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS...7.8 High
- weblate wlcwlc Path traversal: Unsanitized API slugs in download command8.1 High
- aiven-open bigquery-connector-for-apache-kafkaArbitrary File Read in Google BigQuery Sink connector7.7 High
- anaconda dask, dask distributed +1 moreDask distributed Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard5.3 Medium
- openagentplatform diveDive allows One-click Remote Code Execution through Deep Links for MCP Install9.7 Critical
- enterprisedb postgres enterprise manager (pem), postgres enterprise manager +1 morePEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability...6.5 Medium
- rustfsRustFS RPC signature verification logs shared secret2.9 Low
- amd epyc™ 8004 series processors, epyc™ 9004 series processors, epyc™ 9005 series processors +2 more +4 moreWrite what were condition within AMD CPUs may allow an admin-privileged attacker to modify the...4.6 Medium
- stackideas easydiscuss, stackideas.com easydiscuss extension for joomla +1 moreExtension - stackideas.com - Lack of mime type validation in EasyDiscuss component 1.0.0-5.0.15 for Joomla4.8 Medium
- stackideas easydiscuss, stackideas.com easydiscuss extension for joomla +1 moreExtension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla9.4 Critical
- stackideas easydiscuss, stackideas.com easydiscuss extension for joomla +1 moreExtension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla9.4 Critical
- the nu html checker nu html checker, validator +1 moreNu Html Checker (validator.nu) - Restriction bypass vulnerability allowing local SSRF6.9 Medium
- connectwise psa, professional service automation +1 moreSession Cookies Missing HttpOnly Attribute6.5 Medium
- connectwise psa, professional service automation +1 moreStored XSS in Time Entry Audit Trail8.7 High
- abb ability optimaxABB Ability OPTIMAX Authentication Bypass in Single-Sign On9.2 Critical
- Show moreLoading…